ShieldGate Docs

Certificates

ACME HTTP-01

Automate certificates with Let’s Encrypt-style HTTP-01 challenges.

Goal

Issue a certificate through ACME HTTP-01.

Prerequisites

  • Domains on the order match enabled proxy hostnames.
  • Proxy publicly reachable on the challenge path (or your lab equivalent).
  • Worker processing ACME orders.
  • Certificates:Acme:DirectoryUrl set (staging recommended first).

Steps

  1. Open Certificates / ACME accounts and ensure an account exists.
  2. Create an ACME order for your hostnames (no wildcards).
  3. Worker drives HTTP-01: Proxy serves GET /.well-known/acme-challenge/{token} (cache or internal lookup).
  4. On success, certificate is stored and can auto-renew.
  5. Bind for SNI and publish.

Verify

  • Order reaches a completed state.
  • Challenge URL returns the expected key authorization during issuance.
  • Renewal job queues before RenewBeforeDays.

Tips

  • Use staging directory until the flow is proven—production rate limits are strict.
  • Expiry monitor notifies channels within ExpiryWarnDays.